Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1525954

[PATCH 4.4 15/37] ipv4: use new_gw for redirect neigh lookup

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stephen Suryaputra Lin <stephen.suryaputra.lin@gmail.com>


[ Upstream commit 969447f226b451c453ddc83cac6144eaeac6f2e3 ]

In v2.6, ip_rt_redirect() calls arp_bind_neighbour() which returns 0
and then the state of the neigh for the new_gw is checked. If the state
isn't valid then the redirected route is deleted. This behavior is
maintained up to v3.5.7 by check_peer_redirect() because rt->rt_gateway
is assigned to peer->redirect_learned.a4 before calling
ipv4_neigh_lookup().

After commit 5943634fc559 ("ipv4: Maintain redirect and PMTU info in
struct rtable again."), ipv4_neigh_lookup() is performed without the
rt_gateway assigned to the new_gw. In the case when rt_gateway (old_gw)
isn't zero, the function uses it as the key. The neigh is most likely
valid since the old_gw is the one that sends the ICMP redirect message.
Then the new_gw is assigned to fib_nh_exception. The problem is: the
new_gw ARP may never gets resolved and the traffic is blackholed.

So, use the new_gw for neigh lookup.

Changes from v1:
 - use __ipv4_neigh_lookup instead (per Eric Dumazet).

Fixes: 5943634fc559 ("ipv4: Maintain redirect and PMTU info in struct rtable again.")
Signed-off-by: Stephen Suryaputra Lin <ssurya@ieee.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/route.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -747,7 +747,9 @@ static void __ip_do_redirect(struct rtab
 			goto reject_redirect;
 	}
 
-	n = ipv4_neigh_lookup(&rt->dst, NULL, &new_gw);
+	n = __ipv4_neigh_lookup(rt->dst.dev, new_gw);
+	if (!n)
+		n = neigh_create(&arp_tbl, &new_gw, rt->dst.dev);
 	if (!IS_ERR(n)) {
 		if (!(n->nud_state & NUD_VALID)) {
 			neigh_event_send(n, NULL);

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.4 00/37] 4.4.34-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 31/37] sparc64: Convert U1copy_{from,to}_user to accurate exception reporting. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 02/37] net: clear sk_err_soft in sk_clone_lock() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 12/37] fib_trie: Correct /proc/net/route off by one error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 27/37] sparc64: Delete __ret_efault. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 25/37] sparc64: Fix illegal relative branches in hypervisor patched TLB cross-call code. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 10/37] ipv6: dccp: add missing bind_conflict to dccp_ipv6_mapped Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 32/37] sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 24/37] sparc64: Fix instruction count in comment for __hypervisor_flush_tlb_pending. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 07/37] dccp: do not send reset to already closed sockets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 14/37] net: __skb_flow_dissect() must cap its return value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 30/37] sparc64: Convert GENcopy_{from,to}_user to accurate exception reporting. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 05/37] ip6_tunnel: Clear IP6CB in ip6tunnel_xmit() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 35/37] sparc64: Convert U3copy_{from,to}_user to accurate exception reporting. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 33/37] sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 11/37] sctp: assign assoc_id earlier in __sctp_connect Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 19/37] sparc: serial: sunhv: fix a double lock bug Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 16/37] tcp: take care of truncations done by sk_filter() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 23/37] sparc64: Fix illegal relative branches in hypervisor patched TLB code. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 36/37] sparc64: Delete now unused user copy assembler helpers. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 09/37] ipv6: dccp: fix out of bound access in dccp_v6_err() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 17/37] tty: Prevent ldisc drivers from re-using stale tty fields Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 26/37] sparc64: Handle extremely large kernel TLB range flushes more gracefully. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 29/37] sparc64: Convert copy_in_user to accurate exception reporting. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 34/37] sparc64: Convert NG2copy_{from,to}_user to accurate exception reporting. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 15/37] ipv4: use new_gw for redirect neigh lookup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 37/37] sparc64: Delete now unused user copy fixup functions. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 01/37] dctcp: avoid bogus doubling of cwnd after loss Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:50 +0100
  [PATCH 4.4 20/37] sparc64 mm: Fix base TSB sizing when hugetlb pages are used Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:50 +0100
  [PATCH 4.4 04/37] bgmac: stop clearing DMA receive control register right after it is set Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:50 +0100
  [PATCH 4.4 21/37] sparc: Handle negative offsets in arch_jump_label_transform Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:50 +0100
  [PATCH 4.4 08/37] dccp: fix out of bound access in dccp_v4_err() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:50 +0100
  [PATCH 4.4 22/37] sparc64: Handle extremely large kernel TSB range flushes sanely. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:50 +0100
  Re: [PATCH 4.4 00/37] 4.4.34-stable review Guenter Roeck <linux@roeck-us.net> - 2016-11-19 17:30 +0100
  Re: [PATCH 4.4 00/37] 4.4.34-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-11-21 17:40 +0100
    Re: [PATCH 4.4 00/37] 4.4.34-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-21 17:50 +0100

csiph-web